Vulnerability in Sap Business_one
CVE-2021-38180
SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's com…
EPSS: 0.020 (78.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Sap Business_one — versions 10.0
- Sap Se Business One — versions < 10.0
Weakness classification (CWE)
References
- cna@sap.com (x_refsource_MISC, Vendor Advisory)
- cna@sap.com (Permissions Required, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-38180?
- CVE-2021-38180 is a critical-severity vulnerability in Sap Business_one, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 9.8/10. Published 2021-10-12.
- How severe is CVE-2021-38180?
- Critical severity. CVSS v3 base score is 9.8 out of 10.